Set up an Outline VPN server on a virtual machine

Outline is a VPN you host yourself. It has three parts:

• The Outline server runs on your virtual machine (VM).
• Outline Manager is a desktop app. You use it to manage the server and to create access keys.
• Outline Client is the app each user connects with, using an access key you give them.

Outline is not in the App Market today, so you install the server yourself. It is one command. The other two parts are apps you download from getoutline.org.

Before you start

• A Doprax account with credit.
• Outline Manager installed on your own computer.
• A VM on a provider where all ports are open: ProVM or OVH.

Do not use a Hetzner VM for Outline

Outline picks two random high ports: a management port (TCP) and a port for access keys (TCP and UDP). On a Hetzner VM only TCP ports 80, 443 and 19000 to 19100 can be reached from the internet, so Outline Manager and your users could not reach the server.

1. Create the VM

Create a VM as described in Create your first virtual machine, with these choices:

• Choose a provider: ProVM (or OVH).
• Choose an image source: Ubuntu.
• Choose a size: the smallest plan is a reasonable start. You can move to a larger plan later on the VM’s Resize tab.

2. Run the installer

1. Connect to the VM over SSH. The IP address is at the top of the VM’s page.

   ssh root@YOUR_VM_IP

2. Run Outline’s installer:

   sudo bash -c "$(wget -qO- https://raw.githubusercontent.com/OutlineFoundation/outline-apps/master/server_manager/install_scripts/install_server.sh)"

   This is the command from the Outline server README (section “Self-Hosted Installation”). The project moved from the Jigsaw-Code organisation on GitHub to OutlineFoundation; old Jigsaw-Code addresses lead to the same files.

3. If Docker is not installed, the installer asks Would you like to install Docker?. Answer Y.

4. Wait for the line CONGRATULATIONS! Your Outline server is up and running. Under it, the installer prints one line in green that looks like this:

   {"apiUrl":"https://YOUR_VM_IP:PORT/SECRET","certSha256":"..."}

   Copy the whole line, with the curly brackets. Treat it like a password: whoever has it can manage your server.

The installer also names the two ports it chose: Management port ..., for TCP and Access key port ..., for TCP and UDP. On ProVM and OVH there is nothing to open on the Doprax side. If you turned on a firewall inside the VM, such as ufw, allow these two ports there.

If you lose the line, both values are kept on the VM:

cat /opt/outline/access.txt

3. Connect Outline Manager

1. Open Outline Manager on your computer and add a server.
2. Choose Set up Outline anywhere.
3. Paste the line you copied into step 2 of that screen and confirm.

Outline Manager now shows your server.

4. Create access keys

1. In Outline Manager, open your server and add a new access key. Create one key per person, and name it, so that you can remove one person later without affecting the others.
2. Share the key with that person. It is a link that starts with ss://.
3. The person installs Outline Client, adds the key, and connects.

Good to know

• The access keys contain the VM’s IP address. If you change the VM’s IP address, the keys you handed out stop working.
• Updates are automatic. The installer also starts a second container, Watchtower, that fetches new versions of the Outline server.
• A stopped VM is charged at its full price. To stop paying, delete the VM. See Start, stop and delete.